Hunt.io uncovered a Chinese-speaking campaign using AI agents to automate cyberattacks against Asian government, education and industrial targets.

Threat intelligence firm Hunt.io just documented a second, separate China-linked campaign wiring commercial AI models directly into live cyberespionage operations, this time hitting Taiwan’s Kuomintang Party archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Vietnam.

The full report traces the operation through five exposed open directories the operators accidentally left publicly accessible, which is how researchers reconstructed the entire orchestration system from the inside.

“Five open directories, one campaign. The exposed directories map to an AI orchestration host, a Java/CAS exploitation workspace, a fake MySQL deserialization service, a Shellshock and credential-testing node, and a payload-distribution store.” reads the report. “SecFlow split reconnaissance, exploitation, collection, and reporting among specialist workers. The runtime could switch between Claude, Qwen, and DeepSeek profiles without changing the task interface.”

The framework behind the campaign, called SecFlow by the operators, could use different AI models, including Claude, Qwen, and DeepSeek. The operators could switch between them without changing how the system worked. Instead of using the models’ official APIs, SecFlow routed requests through private proxy servers linked to the niestools.com domain.

The AI models did not break into systems on their own. They helped automate and organize traditional hacking tasks, such as scanning for vulnerabilities, testing stolen credentials, trying exploits, deploying webshells, collecting data and evidence, and generating reports. The attackers built the infrastructure that connected these AI capabilities to real-world intrusions.

The most damaging confirmed breach hit a Fengtai District government Office Automation environment in China, and it ran the full playbook from web shell to data theft.

“The most extensive compromise hit a Fengtai District government environment, where the operator achieved command execution, collected LSASS and registry hives, accessed government and health records, and deployed multiple Windows implants. Separate activity exposed a Chinese education AI platform and obtained root database access to a university campus-card system.” Hunt.io states. “SecFlow coordinated reconnaissance, exploitation, and reporting across Claude, Qwen, and DeepSeek workers. “

Operators achieved Windows command execution through internet-facing web applications, then used ASPX web shells not just to run commands but as a persistent operational backbone: querying internal databases, pulling an LSASS memory dump apart in 37 separate chunks to avoid detection, and extracting SAM and SYSTEM registry hives containing password hash material.

“The operator divided the LSASS dump into 37 blocks, requested each block through an authenticated SOCKS route, verified the expected byte count, and reconstructed the complete file.” continues the report. “The operator also collected the SAM and SYSTEM registry hives. Another server-side page, extract.aspx, scanned sections of the memory dump for Windows password-hash material.”

From there they pulled 822 OA user account records, created a new privileged account of their own for backup access, and walked away with 949 attachments totaling 1.28GB, including a chronic-disease report containing real patient health information.

In a separate case, the operators also exposed the management backend of a Chinese education AI platform. The irony is hard to miss: an AI company was compromised partly because its own AI infrastructure was not properly secured.

Hunt.io found a backend that anyone could access without authentication. It exposed 23 AI agent configurations, 14 API secret fields containing credentials, and 104 complete chatbot conversations. Some of those logs included real student data, such as names, student ID numbers, majors and academic advisers, taken from career-guidance and study-partner chats.

The exposed credentials were not just old or unused secrets. They worked against the platform’s live production API, meaning attackers could use the stolen keys to access real systems.

One particularly clever access method used a fake MySQL server as bait rather than a target. A malicious service impersonating a MySQL database would accept connections from vulnerable Java applications, then return specially crafted data designed to trigger unsafe object deserialization on the client side the moment it connected, turning what should have been an outbound database query into inbound code execution. That’s initial access flipped on its head, exploiting the assumption that connecting out to a database is inherently safer than accepting connections in.

The webshell tooling itself, a custom framework the operators called GLUTTON, hid its payloads inside PNG image files using steganography, literally embedding executable code in the red, green, and blue color channel data of ordinary-looking images. A small decoder script on the server would read the image pixel by pixel, XOR-decrypt the hidden bytes using a fixed key, and load the resulting code directly into memory without ever writing an obviously malicious file to disk. Any security control that only checks file extensions or content types for image uploads would sail right past this without noticing anything wrong.

This isn’t an isolated incident for the underlying pattern either. It’s the second campaign in two months where researchers caught commercial AI coding tools embedded as operational components of live nation-state intrusions, following a similar Hunt.io discovery in June involving the same Claude Code and DeepSeek combination against separate government and financial targets in Afghanistan and Thailand. Anthropic itself disclosed a related pattern back in November 2025, describing attackers who convinced Claude it was doing legitimate defensive penetration testing by splitting malicious requests into small, individually harmless-looking pieces.

The operators also left a clear trace across their own infrastructure. The username “Nie” appeared several times in hardcoded file paths inside the GLUTTON tools and was reused in proxy credentials, linking all five compromised workspaces to the same campaign.

For defenders, this is especially important if they use Java frameworks vulnerable to deserialization attacks, older Apache or Grafana systems, or public-facing office automation software. The campaign shows that attackers can treat commercial AI models as interchangeable tools. The key question is no longer which AI model carried out an attack, but how quickly defenders can recognize the attack pattern, regardless of which model was used.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Agents)

Mirage Kitten used fake LinkedIn coding tests to spread NodeRabbit and PollCat, even banning AI tools that could have spotted the malware.

Iran-linked Mirage Kitten hackers just found a genuinely clever way to make their own malware harder to detect: telling job candidates not to use AI tools while reviewing the trojanized code they were sent. Kaspersky’s research documented two previously undocumented malware families from the APT group, delivered through fake coding challenges sent to job seekers on LinkedIn.

The setup is almost embarrassingly simple once you see it laid out. A fake recruiter contacts a software engineer, offers a role, and sends a coding assessment hosted on a completely legitimate-looking Amazon S3 link, the kind of hosting nobody would think twice about.

“During recent threat research, we detected suspicious activity on a system in Afghanistan. We traced it to an archive containing a software development project that the user may have received during a job application process.” reads the report published by Kaspersky. “The archive purported to contain a coding challenge for candidates applying for an engineering role.”

The archive includes a README with a three-hour time limit and an explicit rule against using AI assistants, which sounds like a normal anti-cheating measure until you realize what it’s actually preventing.

Kaspersky spells out exactly why that rule exists.

“The README also imposed a three-hour time limit and prohibited the use of AI assistants.”states the report. “Notably, an AI code-review assistant tasked with auditing the project would likely have flagged the suspicious first-line import of an unknown npm package and warned the targeted developer that the project was trojanized.”

the researchers write, which means the “no AI” instruction isn’t about fairness in a coding test at all, it’s a deliberate move to stop the one tool most likely to catch the malware before it runs.

The first malware family, called NodeRabbit, is written entirely in Node.js and can run on Windows, Linux, and macOS from the same codebase. That’s a change for Mirage Kitten, which has traditionally used malware written in C, C++ and Go.

NodeRabbit is hidden inside a fake npm package included in the coding test rather than published online. Once the victim runs it, the malware starts a background process and connects to infrastructure hosted on Azure, using AES-256-GCM encryption to protect its communications.

Newer versions added checks to detect sandboxes and analysis environments. The malware looks at system memory, the number of CPU cores and how long the machine has been running before deciding whether to continue.

One sample found in Egypt takes that trick a step further. When NodeRabbit suspects it’s being analyzed, it first sends a few harmless requests to Google, Microsoft and Cloudflare, then stops without contacting its real command server. That helps its traffic look like normal background activity instead of an obvious connection to the attackers.

A third variant, found on a system in Ethiopia, expanded the malware’s command set from 11 to 23 and added something genuinely unusual: the ability to plant a fake VS Code extension disguised as “GitHub Copilot Helper,” complete with a stolen publisher name to look legitimate, plus a technique that quietly injects a malicious launcher into a Git repository’s hooks so the malware relaunches every time someone merges or checks out code.

The second malware family, PollCat, takes a stranger route to establish itself. It’s disguised as a React coding challenge that requires entering a six-digit access code supposedly provided by the recruiter, with a ticking countdown designed to pressure the victim into working fast without scrutinizing anything.

“While tracking NodeRabbit infections, we discovered another malicious tool we dubbed PollCat, which is also distributed under the guise of a programming challenge. The sample we obtained resides inside RankChallenge-react, a React code-fixing challenge presented as a time-limited developer assessment. Running the project invokes npm i && node index.js, which starts the local application and attempts to open the challenge in the user’s browser.” states the report. “

What victims don’t realize is that PollCat starts running and begins talking to its command server the moment the application loads, well before anyone types in that access code at all.

Kaspersky linked both malware families to Mirage Kitten with high confidence. Researchers compared PollCat’s network code with an older backdoor called Retrograde, also known as MiniFast, and found that the two use almost the same connection process.

One detail is especially telling: both malware families treat an HTTP 400 error as a successful registration and extract a session token from the response. That unusual behavior is unlikely to appear by chance in two unrelated malware families.

Victims identified so far cluster in fintech and aviation organizations across Egypt, Ethiopia, and Afghanistan, consistent with Mirage Kitten’s long-standing focus on the Middle East and Africa. If your organization does any hiring through LinkedIn outreach involving take-home coding assessments, this is worth flagging to your engineering team directly, because the lure here isn’t a suspicious email with bad grammar, it’s a completely normal-looking job opportunity with a legitimate cloud-hosted download link and a plausible-sounding reason not to use the one tool that would have caught it.

“Mirage Kitten’s latest activity marks a notable evolution in the group’s tooling: NodeRabbit and PollCat are the group’s first Node.js/JavaScript-based implants, departing from its usual native malware deployed through DLL search-order hijacking.” concludes the report.

“The delivery mechanism, however, remains consistent with Mirage Kitten’s historical tradecraft: the use of recruiter personas on LinkedIn to target critical sectors across the Middle East and Africa for cyberespionage purposes. We continue to track the group’s activity and will report on new developments in future publications.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Mirage Kitten)

Huntress found five DPRK-linked workers hired in 2026 using fake identities, remote-access setups and proxy tools to infiltrate legitimate companies.

Companies keep accidentally hiring North Korea-linked individuals as remote workers, and Huntress just published the receipts. The security firm’s investigation documents five confirmed cases in 2026 alone where DPRK-aligned workers, tracked under the name FAMOUS CHOLLIMA, talked their way into legitimate jobs using fake or stolen identities, spanning IT roles, sales and marketing, and even healthcare positions.

The main challenge is that this isn’t a typical cyberattack. These workers get hired, complete the onboarding process and often perform the job they’re paid to do, while sending part of their earnings back to North Korea.

Huntress says the workers aren’t breaking into companies through technical vulnerabilities. Instead, they use fake identities and other tricks to get legitimate jobs, which makes them much harder to spot with traditional security tools.

“DPRK workers present a unique detection challenge for defenders: rather than compromising accounts or breaking in via gaps in the organisations’ environments, they’re tricking companies into remotely hiring them, and oftentimes actually doing the legitimate work they were hired to do.” reads Huntress’s report. “Furthermore, DPRK workers often use stolen identity documents, VPNs, and proxy services to mask their true identity and location, meaning other methods must be used to help verify if an employee is who they say they are.”

The first case, involving three suspected workers at an Australian healthcare partner, came together through document forensics rather than network telemetry. Two employees submitted identity documents, Chinese passports, resident ID cards, and electricity bills, that looked legitimate individually but shared an impossible number of coincidences: identical passport issue cities, dates of issue just one day apart, matching residential streets, and photo metadata showing the same iPhone model used eight minutes apart. Even the fake electricity bills shared the exact same typo, “hassle” rendered as “hassic,” a translation artifact from whatever template both documents were built from.

The second case reads like something out of a spy thriller, except the tradecraft is disturbingly mundane. A newly onboarded worker’s laptop connected to a GL.iNet travel router for hours despite apparently already having arrived at its destination, then landed on a residential WiFi network, then got hooked up to a PiKVM, a Raspberry Pi-based device that gives someone full remote control over a computer at the hardware level, before the OS even boots. Ten minutes after the PiKVM activated, the laptop switched to a permanent ethernet connection and never touched WiFi again, the telltale sign of a machine settling into what Huntress calls a laptop farm.

What gives this timeline away isn’t the PiKVM alone, it’s the almost comically ordinary activity that surrounds it. Within an hour of the device connecting, the worker was googling online audio tests and microphone test websites to make sure their setup actually worked, the exact kind of mundane troubleshooting anyone does with new hardware. A few days later they entered a personal Gmail address into a web form that happened to match a naming pattern Huntress had already tied to other DPRK operatives, and checked their own public IP address minutes before joining a Zoom call, presumably confirming their proxy setup was holding.

The third case, caught through proactive threat hunting rather than a partner tip, showed a slightly different playbook built around remote collaboration tools rather than hardware. This worker used Toffeeshare, an encrypted peer-to-peer file transfer service, to move identity documents that turned out to belong to a real person whose photo had been digitally swapped for the impostor’s face, likely to pass an I-9 employment verification check. They also posted recurring Zoom meeting links, complete with embedded passwords, on a public code-sharing site, and used VDO.Ninja, free streaming software, seemingly to broadcast their own screen for a remote operator watching elsewhere.

The identity theft angle here is worth sitting with for a moment. Huntress found that the stolen identity in this third case belonged to someone whose mugshot had previously circulated online following a real arrest, matching on full name, date of birth, and even the drivers license location, with only the face swapped out. That’s not a fabricated identity built from scratch; it’s a real, searchable person’s life quietly repurposed to get someone else hired at a company that had no way of knowing the documents didn’t belong to the face on the video call.

“The user accessed ip[.]me directly to determine their public-facing IP address just minutes before joining a Zoom meeting.” continues the report. “The employee also retrieved an image from a file-sharing site, potentially for use on an internal communications tool, which is highly suspicious and a red flag in itself”

Huntress recommends looking at several warning signs together rather than relying on one indicator. For example, monitor Windows logs for PiKVM and Guermok capture devices, especially when both appear on the same computer. Also watch for VPN or proxy services such as Astrill and IPRoyal combined with unusual working hours. Recently issued identity documents can also deserve extra checks.

None of these signs proves malicious activity on its own, since VPNs and proxies can have legitimate uses. But when several indicators appear together, for example, a new employee connects a KVM device, tests the microphone, works mainly around midnight UTC and provides an identity document issued at the same time as a coworker’s, the combination should trigger a proper background check before the person gets access to production systems.

“Since fraudulent workers are legitimately onboarded employees, identifying them post-hire involves manual effort and multiple points of evidence that, while individually are not indicative of malice, combined together present a much stronger picture of DPRK worker activity.” concludes the report. “Mitigating the risk of fraudulent workers begins at the interview stage and continues with performing rigorous background checks of new hires prior to onboarding. When in doubt, performing standard background checks, searching the individuals online, and verifying any employment history will help to weed out DPRK workers early in the interview process.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, North Korea-linked IT Workers)

Fire Ant hijacked Cisco routers, stole credentials and altered logs to hide its tracks, using trusted infrastructure to reach high-value networks.

Chinese-linked cyber espionage group Fire Ant has spent the past year quietly graduating from hacking individual computers to hacking the infrastructure that connects them. Sygnia’s new report traces how the group expanded from compromising hypervisors into routers, authentication servers, and Linux management hosts, the unglamorous plumbing that decides who gets to log in where and what gets recorded when they do.

The investigation started with something that looked like a minor configuration mistake. A tunnel interface showed up as active on a Cisco IOS XR router with no corresponding entry in the configuration history, no commit anyone could point to that explained how it got there.

“The investigation began with an anomaly that appeared, at first, to be a configuration inconsistency: a tunnel interface became operational on a Cisco IOS XR router even though no corresponding running configuration or commit history could explain its creation. The interface was associated with a specific VRF and used GRE encapsulation, but standard configuration review did not provide a reliable explanation for how it appeared.” reads the report. “This discrepancy became a key investigative lead because it suggested that the device’s operational state could no longer be trusted to match the configuration and audit records visible to administrators.”

That single inconsistency became the thread that unraveled the whole operation, because it meant the router’s own records could no longer be trusted to reflect what the device was actually doing.

What Fire Ant built inside that router wasn’t generic malware bolted onto Linux. The toolkit was purpose-written for IOS XR’s own internals, hooking into logging, command execution, and routing functions directly. One component disguised itself as a legitimate boot service and ran on a bizarre schedule, active only during odd-numbered hours and shut off during even ones, apparently timed to dodge routine inspection windows. Another modified the router’s own syslog function so that any log message not containing the word “Health” would silently vanish instead of being recorded, a filter so specific it reads like something built to survive a very particular kind of audit.

Following that anomalous tunnel led investigators to a second compromised machine, an aging Linux system acting as the tunnel’s far end. From there, Fire Ant wasn’t just maintaining access, it was actively scanning outward toward other high-value networks, probing SSH, RDP, and web ports on systems connected through the compromised infrastructure.

“The actor appeared to use the compromised environment as an infrastructure platform from which it could explore reachability into connected high-value networks, including critical infrastructure.” states Sygnia. “In this model, routers, TACACS servers and jump hosts are not peripheral assets. They are the path to the target behind the target.”

The authentication layer got its own dedicated attack, and this is the part that should concern anyone who thinks compromised credentials are the worst-case scenario. Fire Ant injected a malicious library directly into a running TACACS authentication daemon, the software responsible for approving administrator logins across network devices, then intercepted live sessions as they were accepted and quietly copied the credential material flowing through. That’s not stealing a password from a phishing page; that’s sitting inside the process whose entire job is deciding who to trust, watching every legitimate login happen in real time.

“The acpid component embedded a modified IOS XR syslog library. In the modified evsyslog flow, log delivery was routed through a custom wrapper that checked for the string “Health” before calling mq_send. When the condition was not met, the wrapper returned a success-like value without forwarding the message, indicating selective manipulation of router log delivery.” states the report.

Fire Ant also used deep, persistent backdoors on Linux systems. Some had remained dormant since 2025 and were disguised as normal system services, making them easy to overlook. One even posed as SentinelOne’s security agent and stayed active in memory after its file was deleted, making standard disk-based forensic checks ineffective on their own.

Perhaps the most technically distinctive piece was a backdoor that didn’t listen on any port at all in the conventional sense. Instead it silently inspected raw network traffic, waiting for specific packets carrying an embedded magic string before it would activate and open an interactive shell. This design shares real code-level overlap with tooling publicly tied to UNC3886, a China-nexus espionage cluster Google and Mandiant have tracked for years, though the specific activation strings and packet-handling logic here differ enough from earlier public reporting that Sygnia treats it as an evolution rather than a straight reuse.

“The key choice is notable because Mandiant previously documented UNC3886 TACACS credential-collection tooling in which captured credential records were also XORed with 0xEF before being written to a credential log file.” continues the report.

Once inside, Fire Ant didn’t just avoid detection, it actively edited the evidence. Login records in Linux’s own wtmp, utmp, and btmp files got rewritten to swap out the router’s real IP address for an internal one, and sudo-related entries were stripped from system logs to erase any trace of privilege escalation. Sygnia’s core warning for defenders cuts against a habit most incident responders have built their careers on: logs are not automatically ground truth anymore, and any investigation into infrastructure this deeply compromised has to cross-check log evidence against memory, disk state, and network telemetry independently rather than trusting any single source on its own.

The bigger concern is that Fire Ant was not mainly interested in the systems it first compromised. It used them as a stepping stone into more valuable networks connected through trusted routing and authentication relationships — what Sygnia calls the “target behind the target.” This means edge routers, TACACS servers and Linux jump hosts can be just as important to protect as systems holding sensitive data, especially when they connect to critical infrastructure. These often-overlooked systems can give a patient and well-resourced attacker a trusted path deeper into the environment, making them a valuable target rather than an unimportant middle layer.

“The central lesson is that defenders must protect more than the systems that store sensitive data. They must protect the infrastructure that makes other systems reachable, trusted, and observable.” concludes the report. “When that layer is compromised, the impact extends beyond a single organization: the actor may gain a vantage point for collection, a path toward connected targets, and the ability to make trusted infrastructure tell an incomplete story.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Fire Ant)

An alleged Chinese-speaking actor breached Philippine nuclear and naval targets by exploiting known flaws, stealing sensitive data.

A suspected Chinese-speaking operator targeted a Philippine nuclear research body and a marine engineering company that supports the Philippine Navy, using well-known vulnerabilities in internet-facing ownCloud and WordPress systems. The activity was uncovered after Hunt.io found an exposed server in Amsterdam that contained attack scripts, logs, offensive tooling and data taken from the two organisations.

“Hunt.io Attack Capture discovered an open directory containing tooling which documented intrusion activity against two Philippine organizations.” reads the report published by Hunt.io. “A recovered CSV references roughly 9 GB of material stolen from the nuclear agency, most absent from the current directories contents, and a compromise of a project management application, indicating a possible third victim.”

Hunt.io disclosed the findings to CERT-PH under the TLP:AMBER sharing standard and delayed publication until 25 August 2026 so the national response team could notify the affected organisations. The incident arrives amid sustained tensions in the South China Sea and continuing reports of suspected Chinese cyber activity against Philippine government, defence and critical-infrastructure targets.

“On August 13, 2026, Hunt.io Attack Capture identified an open directory on the host 31.58.209[.]241. The server staged custom Python scripts, per-file transfer logs, open-source offensive security tooling, and exfiltrated data from two Philippine organizations. The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV.” states the report.”A separate intrusion was observed exploiting a WordPress site operated by a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy.”

The server was not a sophisticated hidden service. It exposed a Python SimpleHTTP directory on port 8000, along with SSH, a self-hosted ownCloud login page and other services. The directory contained 1,310 files in 86 folders, totaling 1.17 GB, including scripts, stolen data and tools such as Sliver, Metasploit and Mettle.

Researchers gained a rare view of the attacker’s operations after finding tools, logs and stolen files left exposed on the server. The main entry point was likely the nuclear research body’s internet-facing ownCloud service, compromised by exploiting CVE-2023-49105, an authentication-bypass flaw in ownCloud versions before 10.13.1.

In this condition, an attacker who knows a valid username can generate WebDAV requests that the server accepts as if they were made by that user. No password is needed. Hunt.io found five custom Python scripts implementing this technique, four focused on individual accounts and a fifth capable of enumerating directories and recording every attempted download. hunt

“In vulnerable instances when no such key was configured, a default state on new installs, the signing routine still executed using an empty secret. An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials.” continues the report. “A total of five custom Python scripts saved from the directory implement this exact technique described above. Four target a single account each; the fifth moves further to include directory enumeration and logging.”

The attacker used random delays to make data collection less noticeable and avoid volume-based alerts. Scripts, logs and folders consistently used Simplified Chinese, including labels for nuclear, radiation-safety, finance and IT files. This suggests a Chinese-speaking operator, but does not prove links to a specific government or threat group.

The stolen data included nuclear reactor component databases, fuel inventories, radiation-safety documents, incident records and authorised-user lists. It also included strategic plans, IT documents, staff records, CVs, passport and travel data, and financial disclosures from Philippine officials.

The exposed server held 176 files, about 372 MB in total. However, a CSV created by the attacker referred to roughly 9 GB of stolen data. This gap suggests the server contained only part of the haul and that the attacker may have accessed much more than researchers could recover.

The material also included a KeePass database, AxCrypt-encrypted files and a BitLocker recovery key. Those artefacts matter because they can support follow-on access: a data theft operation can become a credential-theft operation, and a credential-theft operation can become a longer-term intrusion.

Researchers additionally recovered a 192 MB SQL dump from a ZKTeco BioTime attendance and personnel system. Such a database can link people to badge identifiers, departments and access records, enabling an attacker to build a picture of who works where, who may have sensitive access and which people are worth targeting next.

The same server also contained evidence of a breach involving a Philippine marine engineering and shipbuilding company that works with the Philippine Navy. The attacker exploited CVE-2024-28000, a privilege-escalation flaw in the LiteSpeed Cache WordPress plugin.

The flaw let attackers create a WordPress admin account without authentication by exploiting a predictable security hash through the REST API. Hunt.io found the exploit code, compiled tools and logs showing that the attacker successfully gained admin access.

The attacker also used WordPress XML-RPC to test passwords for the admin account with the well-known rockyou.txt list. The logs show that this method also found valid credentials.

That gave the operator redundancy. Even if one access path were closed, the attacker could retain an administrator account, a valid password or data such as WordPress hashes and secret values from the stolen site database. Redundant access is not glamorous. It is, unfortunately, effective.

While examining the compromised WordPress site, Hunt.io also discovered an active EtherHiding-style injection that it believes may be unrelated to the Chinese-speaking operator. The malicious JavaScript used an Ethereum smart contract as a place to retrieve content, then displayed a fake Google verification page designed to push visitors into a ClickFix-style infection flow.

The campaign used a service worker for persistence and collected visitor fingerprint data. Hunt.io found 174 unique IP addresses hosting pages with the same NoChain loader strings and smart-contract reference, but said the evidence did not link that activity to the operator who attacked the nuclear and naval-linked targets.

That distinction matters. A compromised website can host multiple intrusions or payloads at once, often run by unrelated actors. Analysts should resist the temptation to treat every malicious artefact on one server as evidence of a single campaign.

The technical lesson is blunt: old and known weaknesses still provide access to high-value targets. Organisations using ownCloud should upgrade to version 10.13.3 or later, apply the vendor’s relevant fixes and ensure that pre-signed URLs use a strong, non-empty signing key.

Teams should also examine WebDAV logs for suspicious PROPFIND directory-enumeration requests, large volumes of file retrieval across multiple accounts, or recurring requests from a single source with artificial gaps between them. Low-and-slow collection is still collection.

For WordPress, organisations should update LiteSpeed Cache to version 6.4 or later, remove or restrict XML-RPC when it is not needed, enforce strong unique administrator passwords and require multi-factor authentication. The XML-RPC compromise in this case succeeded against a password from a public wordlist, which is not a vulnerability in WordPress so much as an invitation nobody should leave on the doorstep.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Philippine nuclear and naval targets)

BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments.

Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked group that overlaps with the group APT28, running an entire espionage operation against European government targets using webhook.site, a service built for developers to test HTTP requests, as its command-and-control backbone.

The campaign ran from late September 2025 through early April 2026, targeting government and diplomatic organizations in Romania, Spain, and Türkiye.

“The campaigns delivered a lightweight Windows batch-script backdoor, dubbed “HOOKEDGE,” via macro-enabled Microsoft Word documents using diplomatic-themed lures, including material impersonating Spain’s Ministry of the Presidency, Justice and Relations with the Cortes, created shortly after a September 2025 meeting between Spanish and Moldovan officials.” states the report by Insikt Group.

“Insikt Group assesses with moderate confidence that this activity was conducted by BlueDelta (which overlaps with APT28, Fancy Bear, and Forest Blizzard), a Russian state-sponsored threat group attributed to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU).”

The attackers used a fairly old-school trick: macro-enabled Word documents. One of them looked like a real meeting agenda from Spain’s Ministry of the Presidency and appeared shortly after an actual meeting between Spanish and Moldovan officials. The timing was interesting because it came just before Moldova’s September 2025 parliamentary elections. The document looked credible enough to make the phishing attempt believable.

The backdoor, called HOOKEDGE, is surprisingly simple. It uses a Windows batch script and relies on two webhooks. One receives commands, while the other sends the stolen data back to the attackers. Every 30 minutes, a scheduled task downloads a command file through Microsoft Edge, runs it and sends the results to another endpoint. The malware uses Edge to make the traffic look like normal web activity, making it harder for security tools to spot.

That reliance on a real browser for both tasking and exfiltration is the cleverest part of the whole design.

“A notable aspect of HOOKEDGE is its use of msedge.exe for both tasking and exfiltration. By generating network traffic through a legitimate web browser rather than a commonly abused LotL binary (LOLBin) or a custom binary, the malware blends its communications with normal enterprise browsing activity.” continues the report.

Recorded Future explains, and that’s really the entire evasion strategy in one sentence: don’t build something exotic, just make your traffic look exactly like an employee checking a website.

BlueDelta didn’t build HOOKEDGE from scratch either. It shares deep code and structural overlap with HEADLACE, a backdoor the same group used years earlier, right down to identical JavaScript variable names and the same base64 encoding scheme for automated downloads.

“HOOKEDGE’s code and structural design have significant overlap with HEADLACE, a backdoor used by BlueDelta in previous campaigns.” states the report.

Recorded Future assesses with moderate confidence that HOOKEDGE is a direct evolutionary successor, maintained by the same operators rather than a fresh tool built by a different team, which fits BlueDelta’s long-documented habit of refining working tradecraft instead of reinventing it.

The operation also included a triage mechanism worth understanding on its own. Once a victim showed signs of being worth deeper attention, active communication with the initial webhook endpoints, BlueDelta deployed a second HOOKEDGE payload configured to check in every five minutes instead of thirty, giving operators much faster interactive control over higher-value targets. That two-tier setup also solved a practical infrastructure problem: webhook.site’s free tier caps out at 100 requests per endpoint, so spreading routine and high-priority tasking across separate endpoints kept any single one from getting exhausted mid-operation.

BlueDelta kept tuning the operation continuously rather than treating it as a finished product. Beaconing intervals stretched from 30 minutes to 61, deliberately timed to slip past sandbox environments that typically only watch a sample’s behavior for an hour. The group added canary tracking pixels named things like mailopened.jpg and docopened.jpg to monitor exactly when a phishing email got opened versus when the document itself got opened versus when macros actually executed, essentially building analytics for their own phishing funnel.

“The malicious document also contains a hidden image referencing a remote webhook URL: hxxp://webhook[.]site/62114596-33f5-47fb-9012-0223529e5a13/docopened[.]jpg. This serves as a document-open “canary,” alerting BlueDelta operators when a victim opens the lure. Later variants used the filename doc.jpg in place of docopened.jpg.” states Insik. “Insikt Group also identified webhooks using the filename mailopened.jpg, indicating that BlueDelta likely used a similar canary mechanism to monitor when recipients opened phishing emails, providing operators with visibility into campaign delivery success before any payload execution.”

That kind of detailed tracking of what victims do would look very familiar to a marketing team. The difference is that here the targets are victims, not customers.

For defenders, the useful indicators are quite clear. Block macros in documents downloaded from the internet, monitor scheduled tasks that launch scripts from user-writable folders, and flag Microsoft Edge running in headless mode or making automated connections to file-sharing and webhook services that the organization does not normally use. You don’t need sophisticated tools to spot these behaviors. Even a well-configured monitoring system should be able to detect them early. The worrying part is that a persistent, state-backed group can still rely on a small set of behaviors that defenders can identify and block.

For defenders, the actionable pieces here are concrete rather than abstract. Block macro execution from documents that arrived over the internet, watch for scheduled tasks spawning script interpreters from user-writable folders, and specifically flag Microsoft Edge running in headless mode or making automated requests to file-hosting and webhook services your organization doesn’t actually use for anything legitimate. None of this requires exotic tooling to catch, which is oddly reassuring: a threat group this persistent and state-backed is still, at its core, relying on the same handful of detectable behaviors that a properly configured monitoring setup would catch on day one.

“BlueDelta is likely to continue conducting initial access campaigns against European government and diplomatic organizations in support of Russian intelligence collection. Given the enduring strategic importance of European governance, NATO-related affairs, and diplomatic engagement with former Soviet republics, the intelligence requirements driving this activity are unlikely to diminish in the near term.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, BlueDelta)

Dark Caracal targets Venezuela with GoCaracal, an upgraded Bandook toolkit and an Ethereum fallback for resilient C2 communications.

Dark Caracal is back with new malware and the same hunting grounds. Arctic Wolf Labs researchers link a June 2026 intrusion against a communications organisation in Venezuela to the Lebanon‑linked espionage group, and says it deployed a previously undocumented Go‑based framework called GoCaracal alongside an updated Bandook backdoor.

Dark Caracal is an APT group associated with the Lebanese General Directorate of General. In past campaigns, it targeted entities in Singapore, Cyprus, Chile, Italy, the USA, Turkey, Switzerland, Indonesia, and Germany.

“In June 2026, Arctic Wolf Labs investigated a targeted intrusion affecting a communications organization in Venezuela. We assess with medium confidence that this activity is linked to Dark Caracal, a cyberespionage group associated with Lebanon’s General Directorate of General Security (GDGS) that has historically targeted governments, businesses, journalists, and activists.” reads the report published by Arctic Wolf. “GoCaracal supports separate lightweight and extended build profiles derived from a shared architecture. Both were observed in the same intrusion.”

The delivery method will feel familiar to anyone who has followed the group’s recent campaigns. Phishing emails with financial or tax lures drop weaponised SVG attachments, which redirect victims through URL shorteners to attacker‑controlled sites that serve the real payload.

When a recipient opens one of these SVG files, the embedded content directs the browser to a shortened URL that resolves through a redirector to getpdfdigital[.]cloud, a known attacker site used to stage malicious payloads. The site then delivers a 7‑Zip archive containing a lightweight Go implant that Arctic Wolf identifies as part of the GoCaracal framework.

“While Arctic Wolf did not recover the original phishing email or SVG attachment associated with the intrusion, the artifact’s financial and tax-themed filename, the campaign’s established delivery pattern, and more than 100 related SVG files found communicating with the same malicious hosting site support our assessment that the file was delivered through phishing.” continues the report.

That initial implant is not the endgame. It establishes a foothold and then pulls in a Delphi loader carrying Bandook and a more capable, extended GoCaracal build with broader post‑compromise features.

The two profiles split the work. The lightweight build handles host profiling, encrypted C2, remote shell, payload download and execution, and shellcode injection. The extended build adds file management, browser credential and cookie theft, keylogging, targeted file search, WebRTC remote desktop, hidden browser sessions, a SOCKS5 proxy and persistence mechanisms.

Arctic Wolf traced 249 related samples from January to July 2026 and sees a clear development arc. GoCaracal started as a focused access implant, then became modular, then gained broad post‑compromise capabilities, and finally added an Ethereum‑based C2 fallback while keeping both profiles in play.

“Analysis of 249 related samples revealed two GoCaracal build profiles: a lightweight implant designed to establish access and deliver additional payloads, and an extended build intended for sustained intelligence collection and interactive control.” states the report. “The extended build also supports an Ethereum smart-contract fallback that allows operators to retrieve replacement command-and-control (C2) infrastructure without redeploying the malware.”

That fallback is the most interesting twist. The extended GoCaracal configuration can include an Ethereum smart‑contract address alongside the usual HOST and PORT values. If the malware cannot reach its primary C2 after repeated tries, it calls a public Ethereum JSON‑RPC endpoint, reads a stored value from the contract, and updates its in‑memory C2 address before retrying.

“An extended GoCaracal variant uses Ethereum smart contracts as a fallback source for replacement C2 addresses.” states Artic Wolf “Blockchain activity indicates that the capability was tested and operationalized rather than merely included as dormant code.”

Ethereum does not carry the malware’s entire command channel. Instead, GoCaracal uses it as a backup source for a new C2 address. This lets the attackers change the server the malware contacts without releasing a new version.

Arctic Wolf found a custom Solidity contract called BulletproofC2 that stores a changeable C2 address. Only its owner can update it. Transaction records show that the attackers changed the address to a public IP, suggesting they tested and used the system.

The same wallet also deployed similar contracts on Ethereum’s Sepolia testnet before moving some to the mainnet. The contracts contained both public and private IP addresses, suggesting the attackers first tested the mechanism before using it operationally.

GoCaracal is not replacing Bandook, at least not yet. Arctic Wolf says the two families now run in parallel, with GoCaracal augmenting the group’s existing toolkit and potentially reducing future reliance on Bandook, but current evidence does not show a full swap‑out.

The June 2026 Bandook sample shows deliberate anti‑analysis tweaks. Sequential command identifiers like @0001 through @0136 were replaced with randomised strings, and plugin export names were obfuscated with generic labels, preserving functionality while weakening signature‑based detection built on older naming conventions.

The wider campaign still looks like Dark Caracal. Arctic Wolf identified seven related Spanish‑language, document‑themed domains used to deliver malicious SVGs and downstream payloads, with two previously linked to the group and a new one registered in July 2026 observed delivering GoCaracal.

Infrastructure is compartmentalised. Of 24 unique C2 addresses extracted from GoCaracal samples, 23 sat on AEZA Group‑operated networks, while Bandook C2 addresses were hosted on AlexHost, a provider previously associated with Dark Caracal. That separation likely limits the blast radius if one provider gets hit.

Geographically, the focus remains Latin America. Arctic Wolf sees related artifacts and infrastructure tied to Brazil, Ecuador, Chile, Colombia, El Salvador and Uruguay, and assesses broader regional activity with moderate confidence while continuing to map the scope.

“Taken together, the findings show Dark Caracal is preserving familiar targeting and delivery practices while modernizing their malware and infrastructure.” concludes the report. “Dark Caracal’s continued use of established tooling such as Bandook, combined with the introduction of GoCaracal and its separate C2 footprint, suggests an expanding and increasingly compartmentalized toolkit rather than a wholesale change in operational strategy.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)

SilkParasite APT ran China-nexus cyberespionage across Central Asia, using 7 custom RATs, DLL sideloading, and AI-assisted malware.

Related Posts:

• FBI Seizes QScan and QTRouter Platforms Run by China State Hackers
• Operation CameraSwarm: 14,500 Dahua Cameras Compromised Across Ukraine and Russia
• Core Werewolf Deploys New CoreRAT Malware Against Russian Targets

The post SilkParasite APT Hits Central Asian Governments With 7 RATs appeared first on Daily CyberSecurity.

OpenAI banned Russian ChatGPT accounts backing a fake think tank, IBI, that used AI posts and a fake “sovereignty” index to push pro‑Russia narratives.

OpenAI says it has banned a cluster of ChatGPT accounts that likely originated in Russia and were used to support a covert influence operation. The campaign promoted an organisation called the International Burke Institute, or IBI, a supposed expert community that claimed to be based in Israel.

The operation did not rely on dramatic deepfakes or a viral bot army. It used a more familiar method: build something that looks credible, fill it with enough content to seem legitimate, then use social media to push people toward it. Credibility is often cheaper to fake than to earn.

OpenAI says the operators prompted ChatGPT in Russian to generate comments and posts, mostly in English, for X, Facebook, LinkedIn, Telegram and Substack. They specifically asked the model to avoid linguistic signals that might reveal a Russian origin, and used VPNs to bypass OpenAI’s restriction on access from Russia.

“We banned a cluster of ChatGPT accounts that very likely originated in Russia. The operators prompted in Russian to generate social media comments that were posted on Substack, Telegram, X, Facebook and LinkedIn.” reads the report published by OpenAI, “Most of the comments they generated were in English, and the operators instructe. ChatGPT to hide any linguistic clues that they were Russian. As we do not allow access to our models from Russia, they used VPNs to access our platform.”

The social media content promoted IBI articles or urged readers to follow IBI-linked channels. Some posts came from accounts bearing the institute’s name and logo, while others appeared to come from ordinary users whose main activity was sharing the same material.

The website behind the brand was registered in February 2025 and presented itself as an Israel-based community of international experts. It claimed links to well-known names such as Francis Fukuyama and Noam Chomsky, but OpenAI’s review found that 34 of 36 sampled articles published under expert profiles had been copied from elsewhere online.

“Some of these articles were years old; others were attributed to the wrong authors. For example, one article on the China-Pakistan Economic Corridor appears to have been copied from a Cambridge University Press original, but incorrectly attributed to a professor at the University of Nottingham whose expertise is in South Asian politics.” continues the report.

This was not a case of ChatGPT writing every false article on the site. OpenAI says the website content itself was not generated by its models, and some material appeared to have been written by a Slavic-language speaker and machine-translated. The AI’s role was narrower but still useful: it helped create the promotional layer that sent people toward the site and made the operation appear more active and organic.

“What began as an investigation into AI-generated social media posts led us to a much broader influence operation, built around a website containing copied and misattributed academic work, a “sovereignty” index that cast Russia in a favourable light, and efforts to disguise the operators’ Russian origins.” states OpenAI. “Although the campaign appears to have reached relatively small audiences, its elaborate construction distinguishes it from other Russia-linked⁠(opens in a new window) influence⁠(opens in a new window) operations⁠(opens in a new window) we have disrupted⁠(opens in a new window) since the start of the war in Ukraine.”

The centrepiece was the so-called Sovereignty Index, also called the Burke Index. It ranked countries across political, economic, technological, information, cultural, cognitive and military dimensions, and consistently gave Russia a favourable place while criticising Western states, especially France, Germany, the European Union and the United States. openai

A made-up index can be effective because numbers carry authority even when the method is vague, selective or impossible to audit. Add charts, expert profiles, academic-looking articles and a professional website, and a claim can travel much further than a Telegram post from an anonymous account.

OpenAI found one Telegram channel, “Lahme Ente,” that published German-language posts attacking Ukraine, the EU and the German government while calling for closer ties with Russia. Another operator used ChatGPT to create logos for channels focused on Germany, France, Poland, Türkiye and the United States, then repeatedly asked for Russian-language summaries of their activity.

“As well as generating content about IBI, one of the operators generated German-language posts that were posted on a Telegram channel called “Lahme Ente” (“lame duck”). These posts routinely criticized Ukraine, the EU and the German government, and advocated for better relations with Russia.” continues the report. “A second operator, alongside their IBI-related content, generated logos for a dozen Telegram channels (including Lahme Ente) focused on Germany, the USA, France, Poland and Türkiye. “

One American-facing channel called “American Observer” included awkward English that suggested it was not run by a native speaker. The operators were trying to hide their origin, but language remains a stubborn problem: a VPN can change an IP address, not always a sentence.

The campaign’s immediate reach appears limited. OpenAI says most social posts received few views and the official IBI accounts had low subscriber counts, although its Telegram channels reportedly attracted around 10,000 to 20,000 followers each. Using the Brookings Breakout Scale, OpenAI rated the effort at the lower end of Category Three: activity across multiple platforms with some signs of reaching genuine audiences.

That does not make it irrelevant. Influence operations are often built for scale, reuse and timing rather than instant virality. A network with a website, a recognisable brand, social accounts, apparent experts and ready-made narratives can remain quiet until a political event, election, protest or crisis gives it an opening.

This case also shows what AI changes and what it does not. It does not eliminate the need for operators, infrastructure, stolen material, audience research or political intent. It makes routine tasks cheaper: drafting posts, translating them, changing tone, generating replies, creating branding and monitoring channels at a pace that a small team can sustain.

“The significance of the operation lies less in the audience it reached, however, than in the infrastructure it had built. While the actors only used ChatGPT to produce isolated promotional posts, those posts pointed to an otherwise credible-appearing institution, complete with purported experts, republished academic work and a purported proprietary risk index.” concludes the report. “This illustrates how influence actors can use AI as a supporting tool within a broader effort to manufacture authority, obscure the source of favored narratives, and establish assets that could be scaled over time. It also illustrates how their supporting use of AI can lead to the broader operation being exposed.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OpenAI)

FBI seizes QScan and QTRouter, China-linked platforms used to hide intrusions and target U.S. critical infrastructure.

The U.S. Department of Justice and the FBI have seized two platforms, QScan and QTRouter, used by a China-linked group to hide cyberattacks and target critical infrastructure. The operation matters because it shows how state-backed actors no longer need to build every part of an attack from scratch: they can rely on shared scanning tools, compromised devices, commercial proxy services, and rented servers.

U.S. authorities attribute the activity to a group known as QTFY, which they say operated through the China-based company Nanjing Xinjiuwei Network Technology Company. According to the Justice Department, the group offered hacking services to paying clients that included China’s Ministry of State Security and the People’s Liberation Army.

“The Justice Department and FBI announced court-authorized domain seizures today to deny malicious cyber actors access to two complementary hacking platforms known as “QScan” and “QTRouter,” used to target U.S. critical infrastructure and other sensitive networks. As described in court documents unsealed in the Southern District of California, a People’s Republic of China (PRC) state-sponsored group known as “QTFY,” employed by China-based Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), created and operated QScan and QTRouter.” reads the press release published by DoJ.

According to the Justice Department, QTFY targeted NASA, the Federal Reserve, the Departments of Energy, Justice, and Health and Human Services, the National Institutes of Health, and the U.S. Senate. Those are not random targets caught in a broad scan.

QScan and QTRouter had different jobs. QScan searched the internet for vulnerable devices and automatically infected thousands of exposed Internet of Things devices. Those compromised routers, cameras, appliances, and other connected systems were then added to QTRouter, a proxy network used to route malicious traffic through systems located outside China.

That approach makes attribution and blocking harder. A victim may see an attack coming from what appears to be a local router, a legitimate commercial proxy, or a virtual private server rented in another country. Blocking traffic by country or IP address becomes far less useful when the attacker is borrowing the identity and location of other people’s devices.

“QScan scans and automatically infects thousands of “internet-of-things” (IoT) devices worldwide, which are then added to the QTRouter network of QTFY-controlled devices. QTRouter consists of these compromised IoT devices, as well as commercial proxy service devices and leased virtual private servers.” continues DoJ. “QTRouter then serves as an “obfuscation network” – meaning it allows QTFY and other malicious cyber actors to conceal the PRC-origin of their computer intrusion activities because the malicious communications appear to originate from computers (such as those compromised by QScan) that are outside of the PRC and may even be local to the targeted networks.”

The government did not merely take down a website. The seized domains were hard-coded into QScan and QTRouter and used for core functions such as authentication and command-and-control communication. By taking control of those domains through a court order, the FBI made the malware platforms unable to operate as intended.

This is a useful example of technical disruption rather than simple attribution. Publicly naming a group matters, but it does not stop an operator who already has access to vulnerable devices and a working relay network. Taking away the infrastructure they need to manage that network is more disruptive, at least until they rebuild it.

“Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable.” DoJ states.

The broader operation looks like an industrial service model. QTFY allegedly used QScan to map targets, identify weaknesses, and compromise devices; it then used QTRouter and other proxy layers to hide where the activity actually came from. Lumen’s Black Lotus Labs described the group as a “digital quartermaster,” meaning it supplied infrastructure and services that could support multiple operations at the same time.

“To support its primary objectives, the quartermaster runs a secondary, completely decoupled target profiling utility called “QScan.” While the core proxy network focuses on managing stateful session paths, the QScan framework operates as the front-end scout.” reads a report published by Lumen. “The operations of this quartermaster demonstrate the high degree of industrialization occurring within China-nexus cyber operations. By shifting away from fragmented, ad hoc setups and toward shared multi-tenant utility networks, state-sponsored actors can execute complex campaigns with a high degree of anonymity and speed, and at a global scale.”

The group reportedly exploited both old and newly disclosed vulnerabilities in widely deployed products, including Fortinet SSL-VPN, Citrix ADC, Microsoft Exchange, F5 BIG-IP, Apache Log4j, Atlassian Confluence, Check Point gateways, CrushFTP, Ivanti appliances, and BeyondTrust Remote Support. This is not a reminder that organisations need magic detection. It is a reminder that old vulnerabilities remain useful because somebody, somewhere, will still leave them unpatched.

The attack chain also included web shells, remote-access trojans, stolen or legitimate credentials, and compromised IoT devices used as nearby relay points. That combination allows an attacker to blend into normal-looking traffic and avoids the obvious infrastructure that defenders have learned to block. A hostile connection that looks like a local consumer router is still hostile; it just has better camouflage.

This seizure follows earlier FBI actions against China-linked botnets. In 2025, the FBI removed PlugX malware from more than 4,000 infected U.S. computers linked to Mustang Panda. In 2024, it disrupted a botnet of hundreds of thousands of IoT devices associated with Flax Typhoon, while in 2023 it acted against a Volt Typhoon botnet used to conceal activity targeting U.S. and foreign critical infrastructure.

“For defenders, the operational lesson is straightforward. Inventory internet-facing assets, patch known vulnerabilities quickly, remove unsupported devices, monitor unusual outbound proxy traffic, and do not assume that an IP address tells you who is behind an attack. The same applies to IoT equipment: a router, camera, network appliance, or smart device left exposed and unmanaged can become part of someone else’s attack platform.

“This disruption announced today is among a series of court-authorized technical operations against indiscriminate hacking activities by the PRC.” concludes DoJ.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, QTRouter)

CoreRAT malware powers Core Werewolf attacks on Russian defense and government targets, using fake military PDFs and Telegram phishing.

Related Posts:

• Balonx Sistema: Mexican PhaaS Adds AI Vishing and RAT
• StopAndProtect Malware Turns Hacked WordPress Sites Into a Botnet
• Cisco Talos Exposes UAT-10147 Agentic AI Attacks

The post Core Werewolf Deploys New CoreRAT Malware Against Russian Targets appeared first on Daily CyberSecurity.

Iran-linked hackers shut down a UK power plant for four days in the first confirmed attack of its kind, concurrent with water infrastructure attacks across 12 US states.

Iran-linked hackers shut down a British power plant for four days in what The Telegraph describes as the most successful cyberattack of its kind against UK energy infrastructure.

“Iran shut down a British power plant for four days in an unprecedented cyber attack, The Telegraph can disclose.” reads the report published by The Telegraph. “It is thought to be the first time that hackers affiliated to the Iranian regime have succeeded in closing down such a facility in the UK, and is believed to be the most successful cyber attack of its kind.”

British officials did not name the power plant because of security concerns. Staff worked for four days to restore it, but the plant was small and the outage did not affect the UK’s wider power supply. Still, the government warned power companies and businesses about the incident and provided guidance on how to respond.

The attack was reported to the National Cyber Security Centre (NCSC), part of GCHQ, which helps protect the UK’s critical infrastructure. The NCSC did not comment on the specific incident.

The US water infrastructure attacks hit dozens of wastewater treatment plants across 12 states, causing flooding and loss of pressure from taps. Authorities in affected areas told customers to boil water. The first reports came from Minnesota on July 26, followed by similar breaches in Michigan, Georgia, South Dakota, and New Jersey. The FBI attributed those incidents to “malicious cyber actors”; US government sources later confirmed the threat most likely originated in Tehran.

The UK attack is not thought to have been designed to harm civilians. The more probable intent was to demonstrate that hackers linked to Iran’s Islamic Revolutionary Guard Corps could gain access to UK infrastructure and shut it down at will. A four-day outage at a small generator that nobody outside the industry noticed is, from that perspective, a successful proof of concept.

Iran has accelerated its cyberattacks on Western countries since the US and Israel began air strikes in February. Suspected Iranian operations have been reported in Germany, Poland, Finland, Belgium, and Albania, with Israel and other Middle Eastern countries remaining the most frequent targets. In March, the NCSC advised British organisations to review their security posture in light of the wider conflict. NCSC chief executive Richard Horne said in June that the agency had handled more than 200 attacks on critical national infrastructure in the previous year alone.

The timing is awkward for the intelligence and security committee, which oversees UK spying agencies.

“Experts have long warned that the UK is unprepared for the scale of the threat of malicious cyber attacks from foreign adversaries, and the intelligence and security committee, which oversees spying agencies, reported last year that the chance of an Iranian cyber attack on British infrastructure was “unlikely”.” continues the report.

A Cabinet Office risk assessment published last month placed the probability of a serious and successful cyberattack on domestic infrastructure at between five and twenty-five percent. The same document warned that AI is making attacks faster and cheaper to run, and is lowering the technical bar for anyone wanting to attempt them.

The government’s public response leaned hard on the size of the target. A government source told The Telegraph: “We have thresholds for important generators to legally notify us of cyber activity, and this site is nowhere near. It’s a very small-scale site, less than a rounding error compared to grid capacity.”

A government spokesman said the UK has a strong and resilient energy system and that the incident never threatened the wider power network. While both statements are technically true, they do not answer a key question: should it be considered acceptable for even a small power plant to remain offline for four days?

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Iran-Linked Hackers)

Google tracks three Russia-linked espionage clusters using phishing and legitimate authentication tools to target researchers, diplomats and defense staff.

Google’s Threat Intelligence Group tracked three separate suspected Russia-linked cyber espionage clusters. All three focus on the same thing: abusing authentication features that are supposed to protect accounts to access them instead.

Threat actors target researchers, academics, government officials, think-tank analysts, and defense sector personnel across Europe and the United States. The three clusters are tracked as UNC6293, UNC7005, and UNC5976, and while they operate differently and with different tools, Google published them together for a reason.

“These clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms.” reads the report published by GTIG. “Because these operations abuse legitimate authentication flows which may not immediately seem like phishing attempts to users, GTIG is raising awareness about these social engineering campaigns targeting individuals so that targets can more readily recognize malicious outreach.”

UNC6293 is the oldest of the three and the most precisely attributed. Google assesses with moderate confidence that it’s a sub-cluster of ICE RELIC, the group also tracked as APT29, responsible for initial access operations.

Its operations are narrow by design: typically fewer than five targets at a time, with themes built around diplomatic events and upcoming conferences. Since it was first documented in June 2025, UNC6293 has consistently impersonated US State Department officials to run app password phishing. The technique is simple but effective. The attacker convinces a target to set a specific app password on their account, one that the attacker already knows, and then uses it to log in without triggering two-factor authentication.

By October 2025, UNC6293 was still reusing screenshots from its June phishing lures, including the ms.state.gov reference, while only changing the surrounding text. By June 2026, the group had added OAuth phishing. After logging in to a legitimate service, victims were asked to share a URL or “verification code,” allowing attackers to obtain valid access tokens. The trick works because the login itself is legitimate, while the attackers hide the malicious step elsewhere.

UNC7005, tracked by Microsoft as STORM-2945, is a related but separate cluster first identified in February 2026. Google assesses it’s also connected to ICE RELIC, but notes it operates with lower technical sophistication and worse operational security than UNC6293. It compensates with a wider toolkit. UNC7005 runs app password phishing, device code phishing against both Microsoft and WhatsApp, malware distribution, and OAuth phishing operations, sometimes in the same month.

“UNC7005 also conducts device code phishing operations for both Microsoft and WhatsApp accounts.” continues the report. “The themes of these phishing waves often involve invitations for calls with individuals from notable organizations related to the target’s field or, most recently, invitations to diplomatic events and conferences. “

The GLOBSEC conference spoof is a useful illustration of how UNC7005 works. The actor built a landing page mimicking an invitation to the legitimate GLOBSEC forum in May 2026, collected detailed registration information from targets including, not for the first time in ICE RELIC-linked operations, a wine selection for a fictional dinner, and then presented a Microsoft device code for the target to enter. The registration form still contained a reference to “Embassy security policy” rather than GLOBSEC, a leftover from the previous lure template that the actor hadn’t cleaned up. When Google flagged the page quickly, UNC7005 revised the template within days, citing “technical difficulties” to explain the change to anyone still watching.

UNC7005 also used WhatsApp phishing pages to trick victims into linking their accounts to an attacker-controlled device. The fake pages offered options such as joining a call, opening an encrypted chat or downloading a file. If victims chose the call option, malicious JavaScript asked for microphone and camera access, recorded them, and sent the footage to the attackers.

In late May 2026, UNC7005 ran a broader phishing wave targeting US-based academics, diplomats, and Russia researchers. The lure was a fake “Summit Companion App” to read a document supporting Ukraine.

“In May and June 2026, UNC7005 conducted social engineering operations spoofing WhatsApp. The phishing pages distributed by the attacker lure targets into linking their WhatsApp accounts with an attacker controlled device in order to join a secure WhatsApp call, chat, or document share.” states the report. “The attacker also attempts multiple other methods of compromise after the device is linked.”

Windows users who downloaded it received VIDAR, an off-the-shelf infostealer sold as a service that pulls saved credentials, cookies, and payment data from browsers. Mac users received ATOMIC, also known as AtomicStealer, a macOS infostealer operating the same business model. Neither is custom tooling. The actor’s email address in this operation was nearly identical to one used by UNC6293 a year earlier.

The hospitality captive portal campaign, previously reported by Reliaquest and Microsoft and attributed to Midnight Blizzard, connects directly to UNC7005. Google traces the infrastructure back to April 2026: domains spoofing Microsoft authentication resources, which Google added to Safe Browsing blocklists as they appeared. By mid-July 2026, those same domains were receiving redirects from captive portals at hotels and conference centers. The IP resolution trail links the captive portal infrastructure to the GLOBSEC device code phishing operation and to ENGINELIGHT, a Go-based malware used in a separate limited UNC7005 operation in May 2026.

CHERRYPIE, also known as ChocoShell, is a PowerShell infostealer that adds another interesting detail. Google found comments and code references that appear consistent with AI-generated code, suggesting the attackers may be using an LLM to develop malware. The data it targets overlaps with the commercial infostealers already used by UNC7005, leading Google to suspect that CHERRYPIE could be a customized version of a malware-as-a-service tool.

UNC5976 is the third cluster and the most distinct. It focuses on military, aerospace, defense industrial base, and NGO targets, concentrating geographically on Ukraine and Armenia. Instead of residential proxies for post-compromise access, as UNC6293 and UNC7005 use, it runs dedicated infrastructure. Its OAuth phishing is more automated: the actor registers file-sharing-themed domains, creates Google Cloud projects behind them, and uses cloud-hosted scripts to collect authentication tokens from targets who log in through what looks like a Google sign-in prompt on a fake file-sharing page. Within three months of Google disrupting this infrastructure, UNC5976 had built at least twelve new domains and was already migrating toward non-Google hosting providers.

In April 2026, UNC5976 also distributed HEADRUSH, a malicious Excel plugin, through a domain impersonating a Ukrainian research institute, potentially targeting a Ukrainian aerospace and imaging company. HEADRUSH eventually leads to an HTA downloader, though Google wasn’t able to recover the full infection chain.

The defender challenge that runs through all three clusters is the same one Google names directly.

” The accounts these groups target are often personal, rather than corporate domain-joined accounts, creating a visibility gap for monitoring compromise from an organizational perspective. The likely use of encrypted messenger applications instead of email for initial outreach also presents a challenge to defenders hoping to track and remediate abuse.” concludes the report. “The combination of these tactics not only enables the attacker to conduct quick-turnaround exfiltration operations, but also presents opportunities for the attacker to further phish targets of interest from compromised, legitimate accounts. “

Security teams watching corporate email and endpoint telemetry won’t see the initial contact. By the time a compromised personal account starts being used to phish the target’s contacts, the original access event is already cold.

Google’s practical guidance for individuals: don’t set app passwords for anyone who asks, revoke existing ones you don’t recognize, check WhatsApp’s linked devices list, and treat any OAuth authorization prompt from an unsolicited message as suspicious regardless of how polished the surrounding page looks. High-risk individuals should consider Google’s Advanced Protection Program, which blocks app password creation entirely.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Russia)

The Jewelbug APT group runs espionage alongside cryptocurrency scams. Read our report on Jewelbug APT group operations.

Related Posts:

• Cisco Talos Discovers JWR Phishing Framework
• US Agencies Warn of AI-Generated Exploits Targeting Siemens S7 PLCs
• PATCHCORD Malware Hits Afghan Telecom in New APT36 Campaign

The post Jewelbug APT Group Operations Combine Espionage and Fraud appeared first on Daily CyberSecurity.

A Head Mare TrueConf attack chains two zero-days to install the PhantomCore backdoor via a trojanized client.

Related Posts:

• DEF CON Attendee Suspected in Fake WiFi Attack Targeting Delta Flight 591 Passengers
• UNC6671 Vishing Extortion Rebrands Across 5 Brands
• Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks

The post Head Mare APT Exploits TrueConf Server Flaws to Deploy PhantomCore Backdoor appeared first on Daily CyberSecurity.

Mustang Panda upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making the backdoor harder to detect.

HoneyMyte, also known as Mustang Panda, has pushed its CoolClient backdoor another step deeper into Windows. Kaspersky’s latest analysis shows a new variant that can deploy a signed kernel-mode driver as a Windows service, communicate with it through IOCTL requests, and use it to hide processes, files and registry entries from inspection.

That distinction matters. CoolClient was already a capable espionage tool, with keylogging, clipboard theft, credential harvesting, file management, system reconnaissance and a plugin architecture, but the new driver changes how difficult the implant can be to see and remove. Kaspersky observed the updated variant in intrusions across Pakistan, Mongolia and Myanmar, while the wider victim set also includes Russia and confirmed government entities.

CoolClient first appeared publicly in 2022 through Sophos research, followed by Trend Micro analysis in 2023. Kaspersky documented another evolution in 2025, when the malware gained clipboard theft and HTTP traffic interception for credential harvesting. The latest version keeps those capabilities and adds something more fundamental: kernel-level control.

“The newest CoolClient variant can deploy a signed kernel-mode driver as a Windows service and communicate with it through IOCTL requests. The driver enhances the malware’s stealth by hiding the CoolClient process, protecting related files and registry entries, and preventing them from being inspected or modified.” reads Kaspersky’s report. “The overall design is comparable to the kernel-mode enhancements previously observed in ToneShell, but the CoolClient driver exposes dedicated IOCTL handlers that allow the user-mode backdoor to communicate directly with the driver.”

In the Myanmar campaign described by Kaspersky, Mustang Panda first used PlugX as the post-compromise implant and then deployed CoolClient. Before launching the malware, the actor added exclusions to Microsoft Defender for a fake Windows Defender directory and the executable used as the DLL sideloader.

The deception is straightforward. The attackers created a fake Microsoft\Windows Defender installation directory, copied the CoolClient components there and renamed a legitimate Sangfor executable, normally Sang.exe, to defender.exe. That trusted executable then loads the malicious libngs.dll through DLL sideloading.

Persistence starts early as well. A scheduled task launches defender.exe with SYSTEM privileges at startup, while CoolClient can also create an AutoRun entry and install itself as a Windows service. The malware checks for security software, including several 360 Total Security processes, before taking the service installation route.

The user-mode chain has several stages. libngs.dll acts as the first-stage loader, loadcert.ini handles the second stage, cert.ini provides the final backdoor, and time.ini stores configuration data. The names have changed from earlier variants, but the basic architecture remains familiar.

libngs.dll also tries to look like the legitimate DLL it replaces. It exports dummy functions that call OutputDebugStringA and then terminate, while the actual malicious code sits inside DllMain. The loader decrypts loadcert.ini and loads it directly into memory.

CoolClient prepares the system by establishing persistence, bypassing UAC and injecting its payload into synchost.exe. It then uses an RPC-based technique and parent-process spoofing to gain elevated privileges without relying on a visible administrator prompt.

Once privileged, it extracts the compressed msagent.sys driver, installs it as a Windows service and loads it into the kernel. Through IOCTL requests, CoolClient registers itself as trusted, provides its C2 address and defines the files, registry keys and processes to protect. The driver can then block security tools from accessing or terminating protected components, making the malware harder to detect and remove.

The driver reads its configuration from \REGISTRY\MACHINE\SYSTEM\RNG. The configuration identifies directories, files, registry keys and values to hide or protect, as well as processes that should be ignored or protected.

“To support kernel module hiding, the driver resolves the address of the non-exported kernel variable PsLoadedModuleList at runtime using MmGetSystemRoutineAddress.” continues the report. “This global linked list maintains information about all loaded kernel modules and drivers, allowing the rootkit to enumerate and manipulate module entries.”

For process hiding, the driver dynamically locates ActiveProcessLinks inside the Windows EPROCESS structure instead of depending on a fixed offset. That matters because Windows changes internal structures between versions. Once it finds the correct field, the rootkit can unlink a process from the active process list and later restore it.

The driver also registers object, process and image-load callbacks. These mechanisms let it track processes and restrict access to protected ones, including the CoolClient code running inside synchost.exe. A process that tries to open a protected process or thread can receive reduced access rights, blocking operations such as termination or code injection.

Files get similar treatment through a Windows filesystem minifilter. The driver maintains protected path lists and checks filesystem activity against them, denying access to matching files and directories. Registry protection works in much the same way: protected keys and values disappear from enumeration results, while direct attempts to open, modify or delete them can return STATUS_ACCESS_DENIED.

The driver contains 33 IOCTL handlers, although the analyzed CoolClient sample normally uses only three. The unused handlers reveal just how much more the driver can do: hide kernel modules, inject shellcode, terminate processes, remove PPL protection, manipulate registry values, hide processes and modules, disable kernel notification callbacks, load another kernel driver and even write to an arbitrary kernel address.

That’s an important distinction between capability and observed behavior. Kaspersky didn’t see the sample invoke all of those functions during normal execution, but their presence shows that msagent.sys isn’t a narrowly designed hiding component. It provides a broader kernel-level toolkit that CoolClient can potentially use when needed.

The rootkit doesn’t stop at processes, files and registry entries. It also hooks the Windows Nsiproxy driver to filter network information returned to user mode. CoolClient supplies its C2 IPv4 address to msagent.sys, and the driver removes matching entries before applications receive the network information.

For a defender, that creates an unpleasant problem. A tool looking at network information from user mode may simply fail to see the address associated with the malware’s command-and-control infrastructure. The connection still exists, but the rootkit can interfere with what security software and analysts are allowed to observe.

The driver can also hide kernel modules by manipulating PsLoadedModuleList. When it finds a matching module, it removes the corresponding entry from the kernel’s linked list, preventing the module from appearing in standard enumeration routines.

This is where the new CoolClient variant becomes materially different from a conventional backdoor. An implant running entirely in user mode can still be powerful, but defenders have many opportunities to inspect processes, files, handles and network activity. A kernel component that actively filters those views changes the detection problem.

The driver uses a digital signature linked to Nanjing Ranyi Technology Co., Ltd., with a certificate valid from 2013 to 2014. Kaspersky also found older malicious drivers using the same certificate, but no direct link to CoolClient.

PDB strings mention a “Nanjing Laboratory” and “Zhang Xuejie Yunnan m,” but researchers found no evidence tying them to a specific developer or threat actor. These clues alone do not prove Chinese involvement.

The stronger attribution comes from the wider operation, which matches HoneyMyte activity through CoolClient, PlugX and the deployment techniques observed.

HoneyMyte continues to use PlugX to gain an initial foothold before deploying CoolClient as a secondary backdoor, but the latest version adds kernel-level capabilities. By loading msagent.sys, the malware can hide processes, files and registry entries while blocking security tools from accessing or terminating protected components.

This complicates incident response: finding Sang.exe, defender.exe or libngs.dll is no longer enough. Investigators must also examine drivers, services, registry changes and unusual network activity. The driver includes additional functions for manipulating kernel components, even if they were not observed in use. For defenders, CoolClient is no longer just a backdoor to hunt in user space—it can change what Windows itself reveals.

“The latest CoolClient variant represents a significant evolution of the malware. Rather than operating solely as a user-mode backdoor with plugin support, it now deploys and communicates with a kernel-mode driver that extends its capabilities beyond earlier versions.” concludes the report. “Through this driver, CoolClient can hide and protect processes, files, and registry objects, as well as filter selected network information, making detection and analysis considerably more difficult.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CoolClient)

Acronis uncovered PATCHCORD, a stealthy backdoor targeting Afghan telecom and South Asian infrastructure via fake VPN tools and Google Sheets C2.

Researchers at Acronis just documented an espionage operation that reads like it was built by someone with genuinely good taste in disguises. Their Threat Research Unit report tracks a previously undocumented backdoor called PATCHCORD, hitting Afghan telecom providers and South Asian critical infrastructure through fake VPN installers and management tools branded to look exactly like the real thing.

“Acronis Threat Research Unit (TRU) has identified an ongoing campaign delivering a previously undocumented custom backdoor against Afghan telecom providers and South Asian critical infrastructure organizations. The backdoor, tracked as PATCHCORD, is a compiled C/C++ implant delivered through sector-specific lures, including fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools.” reads the Acronis’s report. “Infrastructure pivoting uncovered SHEETCORD, a Go-based implant that builds on PATCHCORD’s capabilities while abusing Google Sheets for C2 communication. The malware was actively distributed through a domain impersonating India’s National Informatics Centre (NIC).”

The delivery method leans hard into specificity. One installer impersonated Afghan Telecom down to matching the company name, product fields, and even the URL of the real support portal customers actually use, the kind of detail that only comes from someone who studied the target closely rather than mass-producing generic lures. Click through it, and a 64-bit Windows implant quietly installs itself while a real browser session opens normally in the background, so nothing looks wrong to the person who just got infected.

PATCHCORD’s persistence trick is worth pausing on because it’s genuinely sneaky. Instead of the usual registry-only approach, it hijacks the actual shortcut files for Edge, Chrome, and Firefox, backing up the originals and rewriting them to launch the malware first, silently starting the real browser afterward so the shortcut still works exactly as expected.

“PATCHCORD establishes persistence by hijacking browser shortcuts. Before modifying shortcuts, the implant checks whether it is running with elevated privileges and then attempts to hijack shortcuts for Microsoft Edge, Google Chrome and Mozilla Firefox.Browser identifier and executable-name mapping.” continues the report.

“The implant searches for shortcuts associated with Microsoft Edge, Google Chrome and Mozilla Firefox before attempting to hijack them.”

Every time someone clicks their browser icon, the malware runs invisibly in the background before the browser they wanted even opens.

Once installed, PATCHCORD checks in with its command server and waits for instructions, supporting five core capabilities: adjusting how often it phones home, listing running processes, executing shellcode entirely in memory, running arbitrary commands through a hidden shell, and controlling its own browser-hijacking persistence remotely. The in-memory shellcode execution is the standout feature here, since the payload never touches disk at any point, which keeps forensic evidence to a minimum for anyone investigating after the fact.

Pivoting off the infrastructure led researchers to a second, more evolved implant they’re calling SHEETCORD, written in Go and delivered through a domain impersonating India’s National Informatics Centre.

“The Go-based malware combines functionality previously observed in the SHEETCREEP RAT with several capabilities introduced in PATCHCORD, suggesting an evolution of the operator’s tooling.SHEETCORD executing shell command function.” states Acronis.

“The implant implements a remote command execution capability main.executeShellCommand similar to PATCHCORD. However, instead of invoking cmd.exe /c, it executes commands through powershell -Command with script block wrapping, suggesting an evolution of the operator’s tooling.”

This one drops the traditional web server entirely and instead uses the Google Sheets API for command and control, creating a dedicated spreadsheet tab for each victim to send and receive instructions. Hiding malicious traffic inside a service as mundane as Google Sheets is a clever way to blend in with normal corporate network traffic that nobody thinks twice about.

The researchers also found a third malware family, HACKERAI C2 Agent, that uses GitHub Gists for the same purpose and shows clear signs of having been built with AI coding assistance. Acronis pointed to leftover debug messages, AI-style code comments, and a redundant double-XOR routine using the same key twice as tells.

“The implant contains code comments and implementation patterns consistent with AI-assisted code generation. Together, these observations suggest that the malware was developed, at least in part, using LLM-assisted coding tools.” the researchers state.

Threat actors are actually using generative AI in practice, not only for some dramatic autonomous hacking campaign, but just as an ordinary coding shortcut.

What really opened the investigation up was an exposed staging server the operator left unsecured. It contained the operator’s entire toolkit laid bare: SuperShell, a Chinese-language command-and-control framework, multiple remote access trojan frameworks, credential-harvesting tools, exploit code for a known OpenSSH vulnerability, and files that appear to follow an iOS call history database format, hinting the group may have also pulled data off mobile devices. Finding a threat actor’s actual staging server is rare, and it’s the kind of mistake that turns a hard-to-attribute campaign into a much clearer picture very quickly.

Acronis links this activity to APT36, also known as Transparent Tribe, a threat group with a documented history of targeting Indian government and defense organizations, though the researchers rate the connection at moderate rather than full confidence. The reasoning holds up: matching credential-harvesting tools previously seen in confirmed APT36 campaigns, a shared C2 framework independently attributed to the same group by other researchers, and a Google Sheets technique closely resembling an earlier documented campaign already linked to the same actor. None of these signals alone would be conclusive, but stacked together they paint a consistent picture rather than a coincidence.

The infrastructure was still live at the time of publication, with domains steadily rotating while the underlying server stayed the same for months. If your organization touches Afghan telecom operations, Indian government systems, or South Asian energy infrastructure, this is exactly the kind of report worth forwarding to whoever handles phishing awareness training, because the lures here are good enough that “just don’t click suspicious links” isn’t much of a defense on its own.

“The PATCHCORD campaign demonstrates an evolving espionage operation targeting telecom, government, defense, and critical infrastructure organizations across South Asia. The discovery of PATCHCORD, SHEETCORD, and HACKERAI C2 Agent highlights the operator’s continued evolution, from a custom C/C++ backdoor to Go-based implants that abuse legitimate cloud services, including Google Sheets and GitHub Gists, for command-and-control.” concludes the report.

“The exposed staging server and related infrastructure provided valuable insight into the operator’s tooling, campaign development, and operational practices, enabling the identification of additional infrastructure and previously undocumented malware.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, PATCHCORD)

Microsoft says China-linked Storm-1175 is using a new ransomware called StormEncryptor, replacing Medusa in its latest attacks.

Microsoft says China-linked, financially motivated threat actor Storm-1175 has begun using a new ransomware strain called StormEncryptor. The group previously relied on Medusa ransomware. StormEncryptor is written in C++ and encrypts files and adds the .encrypted extension, then leaves a !!!README_FIRST!!!.txt ransom note in each scanned directory. The change suggests an evolution in the group’s ransomware operations.

“While Microsoft has not confirmed the vulnerability targeted by Storm-1175 in this campaign, the threat actor is likely exploiting the CVE-2026-18577 authentication bypass vulnerability in N-able, which was disclosed on August 2, 2026 and added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on August 3, 2026.” wrote Microsoft on X.

Storm-1175 is known for fast ransomware campaigns that exploit newly disclosed vulnerabilities before organizations can patch them. In recent attacks, the group used tools such as AnyDesk and SimpleHelp for remote access, Advanced IP Scanner to map networks, and Mimikatz to dump LSASS credentials.

Microsoft says the attackers can move from initial access to data theft and ransomware deployment within days, highlighting the need for rapid patching and monitoring.

China-based actor Storm-1175 carries out fast, financially driven ransomware attacks by exploiting newly disclosed vulnerabilities before organizations patch them. The group targets exposed systems and quickly moves from initial access to data theft and ransomware deployment, sometimes within 24 hours. The financially motivated group mainly targets sectors such as healthcare, education, finance, and services across the US, UK, and Australia. The attackers often chain exploits, create new accounts for persistence, move laterally using remote tools, steal credentials, and weaken security defenses. Their speed and focus on unpatched systems make them highly effective.

Microsoft researchers report that the group quickly exploits newly disclosed flaws in web-facing systems to gain access. Since 2023, the group has targeted many platforms, including Microsoft Exchange, Ivanti, ConnectWise, JetBrains, and others. It often weaponizes vulnerabilities within days, or even one day, before organizations apply patches.

“Storm-1175 rapidly weaponizes recently disclosed vulnerabilities to obtain initial access.” reads the report published by Microsoft. “Since 2023, Microsoft Threat Intelligence has observed exploitation of over 16 vulnerabilities, including:

• CVE-2026-1731 (BeyondTrust)”
• CVE-2023-21529 (Microsoft Exchange)
• CVE-2023-27351 and CVE-2023-27350 (Papercut)
• CVE-2023-46805 and CVE-2024-21887 (Ivanti Connect Secure and Policy Secure)
• CVE-2024-1709 and CVE-2024-1708 (ConnectWise ScreenConnect)
• CVE-2024-27198 and CVE-2024-27199 (JetBrains TeamCity)
• CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 (SimpleHelp)
• CVE‑2025‑31161 (CrushFTP)
• CVE-2025-10035 (GoAnywhere MFT)
• CVE-2025-52691 and CVE-2026-23760 (SmarterMail)

The attackers also chain multiple exploits to achieve deeper access, such as remote code execution, and have targeted both Windows and Linux systems. In some cases, the threat actor used zero-days even before public disclosure, showing advanced capabilities. By focusing on unpatched systems and acting fast, Storm-1175 maximizes impact and maintains a strong advantage over defenders.

Storm-1175 chains multiple exploits to gain deeper access, as seen in attacks on Microsoft Exchange where it moved from initial access to remote code execution. The group also targets Linux systems and has used zero-day flaws before public disclosure, showing advanced skills.

After gaining access, it installs web shells or remote tools, creates admin accounts, and moves laterally using tools like PowerShell, PsExec, RDP, and Cloudflare tunnels. It also abuses legitimate RMM tools and software like PDQ Deployer and Impacket to spread across networks. The attackers can deploy ransomware in as little as one day, highlighting their speed and efficiency.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China)

Lazarus targets defense professionals with fake Lockheed Martin jobs, exploiting a Windows zero-day to deploy backdoors and evade security controls.

Check Point Research has uncovered a new wave of Operation Dream Job, the long-running North Korean campaign that lures defense and aerospace professionals with convincing fake job offers. This iteration is more dangerous than previous versions: it includes a previously unknown Windows vulnerability now patched as CVE-2026-68820, a newly documented backdoor called Troy, and command infrastructure built almost entirely from legitimate servers the attackers didn’t build, they hijacked them. Targets confirmed in France, Germany, Brazil, and India.

“The attackers used a previously unknown vulnerability in Windows (CVE-2026-68820) to gain full control of infected computers and evade EDR visibility. Check Point reported the issue to Microsoft, which released a fix before this research was published” reads the report published by Check Point Research. “Rather than running their own servers, the attackers are hijacking legitimate but compromised websites and webmail servers to relay commands, making the malicious traffic harder to distinguish from normal activity”

The vulnerability, CVE-2026-68820, is the same actively exploited zero-day that Microsoft patched on August 11 as part of Patch Tuesday, a privilege escalation flaw in AFD.sys, the kernel driver underlying Windows Sockets. Check Point reported the issue to Microsoft on July 28, Microsoft confirmed it three days later, and the fix shipped two weeks after that. The zero-day in this campaign and the zero-day under active exploitation are the same bug.

The attack runs through two parallel infection chains. In the first, victims download an encrypted archive containing a legitimate signed PDF viewer and a malicious DLL. The DLL displays a convincing Lockheed Martin job description while silently loading MISTPEN, a lightweight downloader that communicates through Microsoft Graph API and OneDrive. MISTPEN then runs reconnaissance modules, triggers the AFD.sys exploit to achieve SYSTEM privileges, and deploys ForestTiger, a well-documented Lazarus backdoor, along with an updated version of the group’s kernel-mode rootkit, FudModule 3.1, which can now tamper with Windows Smart App Control to bypass software verification.

“The second chain is more recent and shares several characteristics with a campaign described by ESET against the UAV sector in 2025. Victims are instructed to download SecurityPDF, a trojanized PDF viewer, from one of several websites impersonating Enveil, a legitimate privacy technology company with no actual connection to the attack. Once installed, the modified viewer inspects any PDF opened through it for a hidden marker.” continues the report. “When the marker is present, the application decrypts and launches an embedded payload that loads the Troy backdoor directly into memory.”

Troy is a single DLL implant that supports 17 operator commands covering file operations, shell access, process termination, in-memory DLL injection, and configuration updates. Its name comes from a PDB path embedded in the binary that Check Point also observed in earlier Lazarus samples. Enveil has no connection to the campaign; its brand was simply borrowed because it sounds credible to defense sector professionals.

The C2 infrastructure is built from compromised Roundcube webmail installations and WordPress sites, many vulnerable to CVE-2025-49113, infected with a previously undocumented PHP webshell called RelayShell. RelayShell functions as a relay rather than a traditional backdoor, exchanging commands and responses through simple text files. In at least one confirmed case, an already-breached French organization was used to send phishing messages to new victims — the attackers borrowed the company’s reputation to get past filters. Check Point identified at least 17 unique server identifiers in this relay network, with operators connecting through commercial VPNs to further obscure their location.

The most urgent action is applying the August 2026 Patch Tuesday update, which contains the CVE-2026-68820 fix. For organizations running public-facing Roundcube or CMS installations, the secondary risk is becoming part of the relay infrastructure rather than the intended target: the servers used in this campaign were compromised through leaked credentials and a known unpatched vulnerability, not anything exotic. The full indicators of compromise are in Check Point’s report.

“Given the combination of a zero day vulnerability that now have a patch, a new modular backdoor, and web based infrastructure designed to resemble legitimate traffic, security teams in these sectors should prioritize the August Patch Tuesday update, review the indicators of compromise published in Check Point Research publication, and apply the same level of scrutiny to unsolicited recruiting outreach that they would apply to any unverified download request.” concludes the report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Lazarus)

China-linked hackers reportedly used eight AI agents to breach a government network, steal data and compromise accounts with minimal human oversight.

Israeli cybersecurity firm Dream documented what looks like the first fully autonomous, end-to-end AI hacking operation against a government target. Over four days at the start of July, according to the Financial Times, suspected Chinese hackers ran a tool built entirely from publicly available AI agents that mapped 21 government systems, hunted for vulnerabilities, and switched tactics on its own whenever it hit a wall.

“Suspected Chinese hackers used publicly available AI tools to compromise government websites in Taiwan in a first-of-a-kind breach, highlighting how artificial intelligence is transforming cyber warfare.” reported the Financial Times.

The tool wasn’t a single script running one attack. It deployed up to eight autonomous agents simultaneously, each working a different angle, more like a coordinated hacking team than a piece of malware. By the time researchers found it, the operation had compromised at least 85 government accounts, pulled over 2,500 personnel records, and expanded to hit a nuclear safety agency and at least seven energy companies.

Dream’s chief strategy officer, Amir Becker, spent years running cyber operations for Israel’s Unit 8200 before this, and he’s not easily rattled by new attack tooling. He said flatly he’d never seen anything like this level of autonomy directed at a government before. “This must be the basic assumption of every government around the globe,” Becker said.

He argued that permanent, assumed compromise is now the only realistic starting posture.

Dream won’t officially name the target government, citing company policy, though a person familiar with the matter told the FT it was Taiwan. The clues inside the data point the same direction: internal communications tied to the hacking tool were written in Simplified Chinese, while the data actually stolen from the target came back in Traditional Chinese, the script used almost exclusively by government systems in Taiwan, Hong Kong, and Macau. Taiwan’s Ministry of Digital Affairs declined to confirm anything specific, saying only that incidents involving government agencies follow established response procedures.

What makes this different from an AI model going rogue during a lab test, something Anthropic, OpenAI, and Meta have all separately reported in recent weeks, is that this wasn’t an accident inside a sandbox. Researchers found the toolkit sitting in a 160MB archive, 1,395 files built around two open-source AI agent frameworks, Hermes and OpenClaw, both freely downloadable and designed to let AI models act autonomously on real tasks. Whoever built this deliberately assembled it as a weapon.

Getting the underlying AI model to cooperate took a specific trick rather than brute force. The operators had bypassed the model’s safety guardrails simply by framing the entire hacking campaign as an authorized penetration test, a scenario the model apparently had no reliable way to verify or reject. That’s a strange kind of vulnerability: not a flaw in the code, but a flaw in how convincingly you can lie to a system that’s trying to be helpful.

The part Dream’s researchers found most striking wasn’t the scale, it was the decision-making. The tool kept ranking and reprioritizing possible attack paths as new evidence came in, and when one route hit a dead end, it spun up another agent to search the internet for fresh information and try a different approach, the same iterative process a human red-teamer would run, just without anyone sleeping.

“The most striking feature of the July attack was how the tool continuously ranked and reprioritised possible attack paths based on available evidence, Dream said.” reported the FT. “When one attack path failed, the tool deployed another agent to scour the internet for information and devise a new approach as a human hacker would.”

Taiwan’s National Security Bureau already logged an average of 2.6 million Chinese cyberattacks a day in 2025, up 6% year over year; if a meaningful fraction of that volume starts running with this kind of autonomy, the math on defending against it gets a lot uglier very quickly.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Agents)